Law: There is no general data protection law.

Regulator: The Ministry of Communications and Information Technology (MICEX)

Summary: A Draft Protection of Personal Data Law (the Draft Law) was announced by the Ministry of Information and Communications Technology (MICEX) and is awaiting review from the Islamic Parliament of Iran. However, the expected timeframe for parliamentary deliberations has not been clarified. In particular, the Draft Law provides for the establishment of the Supervisory Board of Personal Data which would be tasked with receiving and processing stakeholder complaints to protect personal data. In the absence of an overarching data privacy law, the legal framework for privacy derives from a patchwork of other laws and regulations dealing with data protection alongside additional matters. Such legislation includes the Law on Publication and Access to Data 2009, the Electronic Commerce Law 2004, and the Cybercrime Law 2009.